Lucene search
+L

28174 matches found

OSV
OSV
•added 2026/09/19 10:58 p.m.•24 views

CVE-2026-93990 Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogate

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpair...

8.7CVSS5.8AI score
SaveExploits0References8
Cvelist
Cvelist
•added 2026/09/19 10:58 p.m.•34 views

CVE-2026-93988 QloApps through 1.7.0 Arbitrary File Read via getEmailHTML

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...

7.1CVSS0.00551EPSS
SaveExploits0References6
CVE
CVE
•added 2026/09/19 10:58 p.m.•21 views

CVE-2026-93988

QloApps versions through 1.7.0 contain a path traversal vulnerability in the getEmailHTML action of admin/ajax.php. An authenticated back-office user can supply relative path sequences in the email parameter to bypass directory restrictions and read arbitrary files , including database credential...

7.1CVSS5.9AI score0.00551EPSS
SaveExploits0References6
OSV
OSV
•added 2026/09/19 10:58 p.m.•8 views

CVE-2026-93988 QloApps through 1.7.0 Arbitrary File Read via getEmailHTML

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...

7.1CVSS6AI score
SaveExploits0References8
Vulnrichment
Vulnrichment
•added 2026/09/19 10:58 p.m.•12 views

CVE-2026-93988 QloApps through 1.7.0 Arbitrary File Read via getEmailHTML

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...

7.1CVSS5.9AI score0.00551EPSS
SaveExploits0References6
Snyk
Snyk
•added 2026/09/19 1:35 p.m.•4 views

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the handling of directory listing responses. An attacker can write files outside the intended destination root by crafting object names containing forward slashes and parent directory references. Details A...

3.1CVSS6AI score0.00288EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/09/19 1:35 p.m.•4 views

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path through the newVolume process in the Docker volume plugin when the name field of a VolumeDriver.Create request is not properly validated. An attacker can cause the creation and mounting of a remote...

4.6CVSS6AI score0.00151EPSS
SaveExploits0References2
OSV
OSV
•added 2026/09/19 12:16 p.m.•7 views

DEBIAN-CVE-2026-93986

rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the...

2.3CVSS5.9AI score0.00288EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/19 12:16 p.m.•14 views

CVE-2026-93986

rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the...

3.1CVSS0.00288EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
•added 2026/09/19 12:16 p.m.•13 views

CVE-2026-93986

rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the...

3.1CVSS5.9AI score0.00288EPSS
SaveExploits0References3
OSV
OSV
•added 2026/09/19 12:16 p.m.•6 views

UBUNTU-CVE-2026-93986

rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the...

3.1CVSS5.9AI score0.00288EPSS
SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/19 11:53 a.m.•56 views

CVE-2026-93986 rclone before 1.75.1 Path Traversal via Directory Listing Names

rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the...

3.1CVSS0.00288EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/19 11:53 a.m.•17 views

EUVD-2026-83591

rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the...

3.1CVSS5.9AI score0.00288EPSS
SaveExploits0References2
CVE
CVE
•added 2026/09/19 11:53 a.m.•34 views

CVE-2026-93986

rclone before 1.75.1 contains a path traversal vulnerability in how it handles names from server and third-party listing responses. The tool fails to confine object names to the listed directory, allowing attackers to craft names containing forward slashes and parent directory references (e.g., ....

3.1CVSS5.9AI score0.00288EPSS
SaveExploits0References2
Debian CVE
Debian CVE
•added 2026/09/19 11:53 a.m.•15 views

CVE-2026-93986

rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the...

3.1CVSS5.9AI score0.00288EPSS
SaveExploits0
Vulnrichment
Vulnrichment
•added 2026/09/19 11:53 a.m.•8 views

CVE-2026-93986 rclone before 1.75.1 Path Traversal via Directory Listing Names

rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the...

3.1CVSS5.9AI score0.00288EPSS
SaveExploits0References2
OSV
OSV
•added 2026/09/19 11:53 a.m.•12 views

CVE-2026-93986 rclone before 1.75.1 Path Traversal via Directory Listing Names

rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the...

2.3CVSS5.9AI score
SaveExploits0References4
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/19 12:00 a.m.•2 views

CVE-2026-93992: Improper Limitation of a Pathname to a Restricted Directory

Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write arbitrary files outside the extraction directory. Attackers can craft malicious archives with entries containing directory traversal sequences that bypass validation, enabling...

8.1CVSS6AI score0.00905EPSS
SaveExploits0References2
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/19 12:00 a.m.•3 views

CVE-2026-93988: Improper Limitation of a Pathname to a Restricted Directory

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...

7.1CVSS5.9AI score0.00551EPSS
SaveExploits0References2
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/19 12:00 a.m.•1 views

CVE-2026-94057: Improper Neutralization of CRLF Sequences

Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing...

5.3CVSS5.8AI score0.00197EPSS
SaveExploits0References3
Rows per page
Query Builder